->Export Table
   Characteristics:        0x00000000
   TimeDateStamp:          0x48025C72  (GMT: Sun Apr 13 19:18:10 2008)
   MajorVersion:           0x0000
   MinorVersion:           0x0000  -> 0.00
   Name:                   0x00006786  ("ntdll.dll")
   Base:                   0x00000001
   NumberOfFunctions:      0x00000523
   NumberOfNames:          0x00000523
   AddressOfFunctions:     0x00003428
   AddressOfNames:         0x000048B4
   AddressOfNameOrdinals:  0x00005D40

   Ordinal RVA        Symbol Name
   ------- ---------- ----------------------------------
   0x0001  0x00057EFB "PropertyLengthAsVariant"
   0x0002  0x00057E63 "RtlConvertPropertyToVariant"
   0x0003  0x00057DC5 "RtlConvertVariantToProperty"
   0x0004  0x00002AD0 "RtlInterlockedPushListSList"
   0x0005  0x00002B30 "RtlUlongByteSwap"
   0x0006  0x00002B40 "RtlUlonglongByteSwap"
   0x0007  0x00002B20 "RtlUshortByteSwap"
   0x0008  0x0001EB58 "CsrAllocateCaptureBuffer"
   0x0009  0x0001EBB9 "CsrAllocateMessagePointer"
   0x000A  0x0001E3AF "CsrCaptureMessageBuffer"
   0x000B  0x0002062D "CsrCaptureMessageMultiUnicodeStringsInPlace"
   0x000C  0x000206EE "CsrCaptureMessageString"
   0x000D  0x0004FE3A "CsrCaptureTimeout"
   0x000E  0x00012D71 "CsrClientCallServer"
   0x000F  0x000211E7 "CsrClientConnectToServer"
   0x0010  0x0001EAFF "CsrFreeCaptureBuffer"
   0x0011  0x0004FE2F "CsrGetProcessId"
   0x0012  0x0004FDAA "CsrIdentifyAlertableThread"
   0x0013  0x0001B08A "CsrNewThread"
   0x0014  0x0004FEBB "CsrProbeForRead"
   0x0015  0x0004FE6D "CsrProbeForWrite"
   0x0016  0x0004FDE6 "CsrSetPriorityClass"
   0x0017  0x0000120E "DbgBreakPoint"
   0x0018  0x0002FB3F "DbgPrint"
   0x0019  0x0001EAD5 "DbgPrintEx"
   0x001A  0x00058082 "DbgPrintReturnControlC"
   0x001B  0x00058171 "DbgPrompt"
   0x001C  0x000581B7 "DbgQueryDebugFilterState"
   0x001D  0x000581C7 "DbgSetDebugFilterState"
   0x001E  0x0004FEF1 "DbgUiConnectToDbg"
   0x001F  0x0004FF9C "DbgUiContinue"
   0x0020  0x000500C4 "DbgUiConvertStateChangeStructure"
   0x0021  0x00050082 "DbgUiDebugActiveProcess"
   0x0022  0x0004FF46 "DbgUiGetThreadDebugObject"
   0x0023  0x00050041 "DbgUiIssueRemoteBreakin"
   0x0024  0x0004FFE3 "DbgUiRemoteBreakin"
   0x0025  0x0004FF58 "DbgUiSetThreadDebugObject"
   0x0026  0x0004FFC1 "DbgUiStopDebugging"
   0x0027  0x0004FF75 "DbgUiWaitStateChange"
   0x0028  0x00001212 "DbgUserBreakPoint"
   0x0029  0x0000E4F0 "KiFastSystemCall"
   0x002A  0x0000E4F4 "KiFastSystemCallRet"
   0x002B  0x0000E500 "KiIntSystemCall"
   0x002C  0x0000E4A8 "KiRaiseUserExceptionDispatcher"
   0x002D  0x0000E430 "KiUserApcDispatcher"
   0x002E  0x0000E440 "KiUserCallbackDispatcher"
   0x002F  0x0000E45C "KiUserExceptionDispatcher"
   0x0030  0x00020998 "LdrAccessOutOfProcessResource"
   0x0031  0x00012788 "LdrAccessResource"
   0x0032  0x0002CAD5 "LdrAddRefDll"
   0x0033  0x00046A5F "LdrAlternateResourcesEnabled"
   0x0034  0x000201A3 "LdrCreateOutOfProcessImage"
   0x0035  0x000202BD "LdrDestroyOutOfProcessImage"
   0x0036  0x0001D6DB "LdrDisableThreadCalloutsForDll"
   0x0037  0x000582E0 "LdrEnumResources"
   0x0038  0x000213E5 "LdrEnumerateLoadedModules"
   0x0039  0x0001FE05 "LdrFindCreateProcessManifest"
   0x003A  0x0005824B "LdrFindEntryForAddress"
   0x003B  0x0001C24D "LdrFindResourceDirectory_U"
   0x003C  0x0005900E "LdrFindResourceEx_U"
   0x003D  0x00012767 "LdrFindResource_U"
   0x003E  0x0002ED22 "LdrFlushAlternateResourceModules"
   0x003F  0x00016680 "LdrGetDllHandle"
   0x0040  0x000166A1 "LdrGetDllHandleEx"
   0x0041  0x00017E88 "LdrGetProcedureAddress"
   0x0042  0x000503AE "LdrHotPatchRoutine"
   0x0043  0x00050E92 "LdrInitShimEngineDynamic"
   0x0044  0x00001166 "LdrInitializeThunk"
   0x0045  0x000127E8 "LdrLoadAlternateResourceModule"
   0x0046  0x000163A3 "LdrLoadDll"
   0x0047  0x00012C43 "LdrLockLoaderLock"
   0x0048  0x000596FC "LdrProcessRelocationBlock"
   0x0049  0x0001CC83 "LdrQueryImageFileExecutionOptions"
   0x004A  0x00050C01 "LdrQueryProcessModuleInformation"
   0x004B  0x00050C21 "LdrSetAppCompatDllRedirectionCallback"
   0x004C  0x000221FF "LdrSetDllManifestProber"
   0x004D  0x00023BB8 "LdrShutdownProcess"
   0x004E  0x00013936 "LdrShutdownThread"
   0x004F  0x00019931 "LdrUnloadAlternateResourceModule"
   0x0050  0x0001736B "LdrUnloadDll"
   0x0051  0x00012CF9 "LdrUnlockLoaderLock"
   0x0052  0x00030A0C "LdrVerifyImageMatchesChecksum"
   0x0053  0x0007B098 "NlsAnsiCodePage"
   0x0054  0x0007B0A0 "NlsMbCodePageTag"
   0x0055  0x0007B0A8 "NlsMbOemCodePageTag"
   0x0056  0x0000CE40 "NtAcceptConnectPort"
   0x0057  0x0000CE50 "NtAccessCheck"
   0x0058  0x0000CE60 "NtAccessCheckAndAuditAlarm"
   0x0059  0x0000CE70 "NtAccessCheckByType"
   0x005A  0x0000CE80 "NtAccessCheckByTypeAndAuditAlarm"
   0x005B  0x0000CE90 "NtAccessCheckByTypeResultList"
   0x005C  0x0000CEA0 "NtAccessCheckByTypeResultListAndAuditAlarm"
   0x005D  0x0000CEB0 "NtAccessCheckByTypeResultListAndAuditAlarmByHandle"
   0x005E  0x0000CEC0 "NtAddAtom"
   0x005F  0x0000CED0 "NtAddBootEntry"
   0x0060  0x0000CEE0 "NtAdjustGroupsToken"
   0x0061  0x0000CEF0 "NtAdjustPrivilegesToken"
   0x0062  0x0000CF00 "NtAlertResumeThread"
   0x0063  0x0000CF10 "NtAlertThread"
   0x0064  0x0000CF20 "NtAllocateLocallyUniqueId"
   0x0065  0x0000CF30 "NtAllocateUserPhysicalPages"
   0x0066  0x0000CF40 "NtAllocateUuids"
   0x0067  0x0000CF50 "NtAllocateVirtualMemory"
   0x0068  0x0000CF60 "NtAreMappedFilesTheSame"
   0x0069  0x0000CF70 "NtAssignProcessToJobObject"
   0x006A  0x0000CF80 "NtCallbackReturn"
   0x006B  0x0000CF90 "NtCancelDeviceWakeupRequest"
   0x006C  0x0000CFA0 "NtCancelIoFile"
   0x006D  0x0000CFB0 "NtCancelTimer"
   0x006E  0x0000CFC0 "NtClearEvent"
   0x006F  0x0000CFD0 "NtClose"
   0x0070  0x0000CFE0 "NtCloseObjectAuditAlarm"
   0x0071  0x0000CFF0 "NtCompactKeys"
   0x0072  0x0000D000 "NtCompareTokens"
   0x0073  0x0000D010 "NtCompleteConnectPort"
   0x0074  0x0000D020 "NtCompressKey"
   0x0075  0x0000D030 "NtConnectPort"
   0x0076  0x0000D040 "NtContinue"
   0x0077  0x0000D050 "NtCreateDebugObject"
   0x0078  0x0000D060 "NtCreateDirectoryObject"
   0x0079  0x0000D070 "NtCreateEvent"
   0x007A  0x0000D080 "NtCreateEventPair"
   0x007B  0x0000D090 "NtCreateFile"
   0x007C  0x0000D0A0 "NtCreateIoCompletion"
   0x007D  0x0000D0B0 "NtCreateJobObject"
   0x007E  0x0000D0C0 "NtCreateJobSet"
   0x007F  0x0000D0D0 "NtCreateKey"
   0x0080  0x0000DFB0 "NtCreateKeyedEvent"
   0x0081  0x0000D0E0 "NtCreateMailslotFile"
   0x0082  0x0000D0F0 "NtCreateMutant"
   0x0083  0x0000D100 "NtCreateNamedPipeFile"
   0x0084  0x0000D110 "NtCreatePagingFile"
   0x0085  0x0000D120 "NtCreatePort"
   0x0086  0x0000D130 "NtCreateProcess"
   0x0087  0x0000D140 "NtCreateProcessEx"
   0x0088  0x0000D150 "NtCreateProfile"
   0x0089  0x0000D160 "NtCreateSection"
   0x008A  0x0000D170 "NtCreateSemaphore"
   0x008B  0x0000D180 "NtCreateSymbolicLinkObject"
   0x008C  0x0000D190 "NtCreateThread"
   0x008D  0x0000D1A0 "NtCreateTimer"
   0x008E  0x0000D1B0 "NtCreateToken"
   0x008F  0x0000D1C0 "NtCreateWaitablePort"
   0x0090  0x0000121E "NtCurrentTeb"
   0x0091  0x0000D1D0 "NtDebugActiveProcess"
   0x0092  0x0000D1E0 "NtDebugContinue"
   0x0093  0x0000D1F0 "NtDelayExecution"
   0x0094  0x0000D200 "NtDeleteAtom"
   0x0095  0x0000D210 "NtDeleteBootEntry"
   0x0096  0x0000D220 "NtDeleteFile"
   0x0097  0x0000D230 "NtDeleteKey"
   0x0098  0x0000D240 "NtDeleteObjectAuditAlarm"
   0x0099  0x0000D250 "NtDeleteValueKey"
   0x009A  0x0000D260 "NtDeviceIoControlFile"
   0x009B  0x0000D270 "NtDisplayString"
   0x009C  0x0000D280 "NtDuplicateObject"
   0x009D  0x0000D290 "NtDuplicateToken"
   0x009E  0x0000D2A0 "NtEnumerateBootEntries"
   0x009F  0x0000D2B0 "NtEnumerateKey"
   0x00A0  0x0000D2C0 "NtEnumerateSystemEnvironmentValuesEx"
   0x00A1  0x0000D2D0 "NtEnumerateValueKey"
   0x00A2  0x0000D2E0 "NtExtendSection"
   0x00A3  0x0000D2F0 "NtFilterToken"
   0x00A4  0x0000D300 "NtFindAtom"
   0x00A5  0x0000D310 "NtFlushBuffersFile"
   0x00A6  0x0000D320 "NtFlushInstructionCache"
   0x00A7  0x0000D330 "NtFlushKey"
   0x00A8  0x0000D340 "NtFlushVirtualMemory"
   0x00A9  0x0000D350 "NtFlushWriteBuffer"
   0x00AA  0x0000D360 "NtFreeUserPhysicalPages"
   0x00AB  0x0000D370 "NtFreeVirtualMemory"
   0x00AC  0x0000D380 "NtFsControlFile"
   0x00AD  0x0000D390 "NtGetContextThread"
   0x00AE  0x0000D3A0 "NtGetDevicePowerState"
   0x00AF  0x0000D3B0 "NtGetPlugPlayEvent"
   0x00B0  0x0000D3C0 "NtGetWriteWatch"
   0x00B1  0x0000D3D0 "NtImpersonateAnonymousToken"
   0x00B2  0x0000D3E0 "NtImpersonateClientOfPort"
   0x00B3  0x0000D3F0 "NtImpersonateThread"
   0x00B4  0x0000D400 "NtInitializeRegistry"
   0x00B5  0x0000D410 "NtInitiatePowerAction"
   0x00B6  0x0000D420 "NtIsProcessInJob"
   0x00B7  0x0000D430 "NtIsSystemResumeAutomatic"
   0x00B8  0x0000D440 "NtListenPort"
   0x00B9  0x0000D450 "NtLoadDriver"
   0x00BA  0x0000D470 "NtLoadKey2"
   0x00BB  0x0000D460 "NtLoadKey"
   0x00BC  0x0000D480 "NtLockFile"
   0x00BD  0x0000D490 "NtLockProductActivationKeys"
   0x00BE  0x0000D4A0 "NtLockRegistryKey"
   0x00BF  0x0000D4B0 "NtLockVirtualMemory"
   0x00C0  0x0000D4C0 "NtMakePermanentObject"
   0x00C1  0x0000D4D0 "NtMakeTemporaryObject"
   0x00C2  0x0000D4E0 "NtMapUserPhysicalPages"
   0x00C3  0x0000D4F0 "NtMapUserPhysicalPagesScatter"
   0x00C4  0x0000D500 "NtMapViewOfSection"
   0x00C5  0x0000D510 "NtModifyBootEntry"
   0x00C6  0x0000D520 "NtNotifyChangeDirectoryFile"
   0x00C7  0x0000D530 "NtNotifyChangeKey"
   0x00C8  0x0000D540 "NtNotifyChangeMultipleKeys"
   0x00C9  0x0000D550 "NtOpenDirectoryObject"
   0x00CA  0x0000D560 "NtOpenEvent"
   0x00CB  0x0000D570 "NtOpenEventPair"
   0x00CC  0x0000D580 "NtOpenFile"
   0x00CD  0x0000D590 "NtOpenIoCompletion"
   0x00CE  0x0000D5A0 "NtOpenJobObject"
   0x00CF  0x0000D5B0 "NtOpenKey"
   0x00D0  0x0000DFC0 "NtOpenKeyedEvent"
   0x00D1  0x0000D5C0 "NtOpenMutant"
   0x00D2  0x0000D5D0 "NtOpenObjectAuditAlarm"
   0x00D3  0x0000D5E0 "NtOpenProcess"
   0x00D4  0x0000D5F0 "NtOpenProcessToken"
   0x00D5  0x0000D600 "NtOpenProcessTokenEx"
   0x00D6  0x0000D610 "NtOpenSection"
   0x00D7  0x0000D620 "NtOpenSemaphore"
   0x00D8  0x0000D630 "NtOpenSymbolicLinkObject"
   0x00D9  0x0000D640 "NtOpenThread"
   0x00DA  0x0000D650 "NtOpenThreadToken"
   0x00DB  0x0000D660 "NtOpenThreadTokenEx"
   0x00DC  0x0000D670 "NtOpenTimer"
   0x00DD  0x0000D680 "NtPlugPlayControl"
   0x00DE  0x0000D690 "NtPowerInformation"
   0x00DF  0x0000D6A0 "NtPrivilegeCheck"
   0x00E0  0x0000D6B0 "NtPrivilegeObjectAuditAlarm"
   0x00E1  0x0000D6C0 "NtPrivilegedServiceAuditAlarm"
   0x00E2  0x0000D6D0 "NtProtectVirtualMemory"
   0x00E3  0x0000D6E0 "NtPulseEvent"
   0x00E4  0x0000D6F0 "NtQueryAttributesFile"
   0x00E5  0x0000D700 "NtQueryBootEntryOrder"
   0x00E6  0x0000D710 "NtQueryBootOptions"
   0x00E7  0x0000D720 "NtQueryDebugFilterState"
   0x00E8  0x0000D730 "NtQueryDefaultLocale"
   0x00E9  0x0000D740 "NtQueryDefaultUILanguage"
   0x00EA  0x0000D750 "NtQueryDirectoryFile"
   0x00EB  0x0000D760 "NtQueryDirectoryObject"
   0x00EC  0x0000D770 "NtQueryEaFile"
   0x00ED  0x0000D780 "NtQueryEvent"
   0x00EE  0x0000D790 "NtQueryFullAttributesFile"
   0x00EF  0x0000D7A0 "NtQueryInformationAtom"
   0x00F0  0x0000D7B0 "NtQueryInformationFile"
   0x00F1  0x0000D7C0 "NtQueryInformationJobObject"
   0x00F2  0x0000D7D0 "NtQueryInformationPort"
   0x00F3  0x0000D7E0 "NtQueryInformationProcess"
   0x00F4  0x0000D7F0 "NtQueryInformationThread"
   0x00F5  0x0000D800 "NtQueryInformationToken"
   0x00F6  0x0000D810 "NtQueryInstallUILanguage"
   0x00F7  0x0000D820 "NtQueryIntervalProfile"
   0x00F8  0x0000D830 "NtQueryIoCompletion"
   0x00F9  0x0000D840 "NtQueryKey"
   0x00FA  0x0000D850 "NtQueryMultipleValueKey"
   0x00FB  0x0000D860 "NtQueryMutant"
   0x00FC  0x0000D870 "NtQueryObject"
   0x00FD  0x0000D880 "NtQueryOpenSubKeys"
   0x00FE  0x0000D890 "NtQueryPerformanceCounter"
   0x00FF  0x0000DFF0 "NtQueryPortInformationProcess"
   0x0100  0x0000D8A0 "NtQueryQuotaInformationFile"
   0x0101  0x0000D8B0 "NtQuerySection"
   0x0102  0x0000D8C0 "NtQuerySecurityObject"
   0x0103  0x0000D8D0 "NtQuerySemaphore"
   0x0104  0x0000D8E0 "NtQuerySymbolicLinkObject"
   0x0105  0x0000D8F0 "NtQuerySystemEnvironmentValue"
   0x0106  0x0000D900 "NtQuerySystemEnvironmentValueEx"
   0x0107  0x0000D910 "NtQuerySystemInformation"
   0x0108  0x0000D920 "NtQuerySystemTime"
   0x0109  0x0000D930 "NtQueryTimer"
   0x010A  0x0000D940 "NtQueryTimerResolution"
   0x010B  0x0000D950 "NtQueryValueKey"
   0x010C  0x0000D960 "NtQueryVirtualMemory"
   0x010D  0x0000D970 "NtQueryVolumeInformationFile"
   0x010E  0x0000D980 "NtQueueApcThread"
   0x010F  0x0000D990 "NtRaiseException"
   0x0110  0x0000D9A0 "NtRaiseHardError"
   0x0111  0x0000D9B0 "NtReadFile"
   0x0112  0x0000D9C0 "NtReadFileScatter"
   0x0113  0x0000D9D0 "NtReadRequestData"
   0x0114  0x0000D9E0 "NtReadVirtualMemory"
   0x0115  0x0000D9F0 "NtRegisterThreadTerminatePort"
   0x0116  0x0000DFD0 "NtReleaseKeyedEvent"
   0x0117  0x0000DA00 "NtReleaseMutant"
   0x0118  0x0000DA10 "NtReleaseSemaphore"
   0x0119  0x0000DA20 "NtRemoveIoCompletion"
   0x011A  0x0000DA30 "NtRemoveProcessDebug"
   0x011B  0x0000DA40 "NtRenameKey"
   0x011C  0x0000DA50 "NtReplaceKey"
   0x011D  0x0000DA60 "NtReplyPort"
   0x011E  0x0000DA70 "NtReplyWaitReceivePort"
   0x011F  0x0000DA80 "NtReplyWaitReceivePortEx"
   0x0120  0x0000DA90 "NtReplyWaitReplyPort"
   0x0121  0x0000DAA0 "NtRequestDeviceWakeup"
   0x0122  0x0000DAB0 "NtRequestPort"
   0x0123  0x0000DAC0 "NtRequestWaitReplyPort"
   0x0124  0x0000DAD0 "NtRequestWakeupLatency"
   0x0125  0x0000DAE0 "NtResetEvent"
   0x0126  0x0000DAF0 "NtResetWriteWatch"
   0x0127  0x0000DB00 "NtRestoreKey"
   0x0128  0x0000DB10 "NtResumeProcess"
   0x0129  0x0000DB20 "NtResumeThread"
   0x012A  0x0000DB30 "NtSaveKey"
   0x012B  0x0000DB40 "NtSaveKeyEx"
   0x012C  0x0000DB50 "NtSaveMergedKeys"
   0x012D  0x0000DB60 "NtSecureConnectPort"
   0x012E  0x0000DB70 "NtSetBootEntryOrder"
   0x012F  0x0000DB80 "NtSetBootOptions"
   0x0130  0x0000DB90 "NtSetContextThread"
   0x0131  0x0000DBA0 "NtSetDebugFilterState"
   0x0132  0x0000DBB0 "NtSetDefaultHardErrorPort"
   0x0133  0x0000DBC0 "NtSetDefaultLocale"
   0x0134  0x0000DBD0 "NtSetDefaultUILanguage"
   0x0135  0x0000DBE0 "NtSetEaFile"
   0x0136  0x0000DBF0 "NtSetEvent"
   0x0137  0x0000DC00 "NtSetEventBoostPriority"
   0x0138  0x0000DC10 "NtSetHighEventPair"
   0x0139  0x0000DC20 "NtSetHighWaitLowEventPair"
   0x013A  0x0000DC30 "NtSetInformationDebugObject"
   0x013B  0x0000DC40 "NtSetInformationFile"
   0x013C  0x0000DC50 "NtSetInformationJobObject"
   0x013D  0x0000DC60 "NtSetInformationKey"
   0x013E  0x0000DC70 "NtSetInformationObject"
   0x013F  0x0000DC80 "NtSetInformationProcess"
   0x0140  0x0000DC90 "NtSetInformationThread"
   0x0141  0x0000DCA0 "NtSetInformationToken"
   0x0142  0x0000DCB0 "NtSetIntervalProfile"
   0x0143  0x0000DCC0 "NtSetIoCompletion"
   0x0144  0x0000DCD0 "NtSetLdtEntries"
   0x0145  0x0000DCE0 "NtSetLowEventPair"
   0x0146  0x0000DCF0 "NtSetLowWaitHighEventPair"
   0x0147  0x0000DD00 "NtSetQuotaInformationFile"
   0x0148  0x0000DD10 "NtSetSecurityObject"
   0x0149  0x0000DD20 "NtSetSystemEnvironmentValue"
   0x014A  0x0000DD30 "NtSetSystemEnvironmentValueEx"
   0x014B  0x0000DD40 "NtSetSystemInformation"
   0x014C  0x0000DD50 "NtSetSystemPowerState"
   0x014D  0x0000DD60 "NtSetSystemTime"
   0x014E  0x0000DD70 "NtSetThreadExecutionState"
   0x014F  0x0000DD80 "NtSetTimer"
   0x0150  0x0000DD90 "NtSetTimerResolution"
   0x0151  0x0000DDA0 "NtSetUuidSeed"
   0x0152  0x0000DDB0 "NtSetValueKey"
   0x0153  0x0000DDC0 "NtSetVolumeInformationFile"
   0x0154  0x0000DDD0 "NtShutdownSystem"
   0x0155  0x0000DDE0 "NtSignalAndWaitForSingleObject"
   0x0156  0x0000DDF0 "NtStartProfile"
   0x0157  0x0000DE00 "NtStopProfile"
   0x0158  0x0000DE10 "NtSuspendProcess"
   0x0159  0x0000DE20 "NtSuspendThread"
   0x015A  0x0000DE30 "NtSystemDebugControl"
   0x015B  0x0000DE40 "NtTerminateJobObject"
   0x015C  0x0000DE50 "NtTerminateProcess"
   0x015D  0x0000DE60 "NtTerminateThread"
   0x015E  0x0000DE70 "NtTestAlert"
   0x015F  0x0000DE80 "NtTraceEvent"
   0x0160  0x0000DE90 "NtTranslateFilePath"
   0x0161  0x0000DEA0 "NtUnloadDriver"
   0x0162  0x0000DEB0 "NtUnloadKey"
   0x0163  0x0000DEC0 "NtUnloadKeyEx"
   0x0164  0x0000DED0 "NtUnlockFile"
   0x0165  0x0000DEE0 "NtUnlockVirtualMemory"
   0x0166  0x0000DEF0 "NtUnmapViewOfSection"
   0x0167  0x0000DF00 "NtVdmControl"
   0x0168  0x0000DF10 "NtWaitForDebugEvent"
   0x0169  0x0000DFE0 "NtWaitForKeyedEvent"
   0x016A  0x0000DF20 "NtWaitForMultipleObjects"
   0x016B  0x0000DF30 "NtWaitForSingleObject"
   0x016C  0x0000DF40 "NtWaitHighEventPair"
   0x016D  0x0000DF50 "NtWaitLowEventPair"
   0x016E  0x0000DF60 "NtWriteFile"
   0x016F  0x0000DF70 "NtWriteFileGather"
   0x0170  0x0000DF80 "NtWriteRequestData"
   0x0171  0x0000DF90 "NtWriteVirtualMemory"
   0x0172  0x0000DFA0 "NtYieldExecution"
   0x0173  0x0005A669 "PfxFindPrefix"
   0x0174  0x0005A321 "PfxInitialize"
   0x0175  0x0005A586 "PfxInsertPrefix"
   0x0176  0x0005A33F "PfxRemovePrefix"
   0x0177  0x0002B183 "RtlAbortRXact"
   0x0178  0x000299F9 "RtlAbsoluteToSelfRelativeSD"
   0x0179  0x000103ED "RtlAcquirePebLock"
   0x017A  0x0002A076 "RtlAcquireResourceExclusive"
   0x017B  0x00029F9F "RtlAcquireResourceShared"
   0x017C  0x000177E3 "RtlActivateActivationContext"
   0x017D  0x0001765D "RtlActivateActivationContextEx"
   0x017E  0x00001198 "RtlActivateActivationContextUnsafeFast"
   0x017F  0x0001881B "RtlAddAccessAllowedAce"
   0x0180  0x00029A29 "RtlAddAccessAllowedAceEx"
   0x0181  0x0005AA73 "RtlAddAccessAllowedObjectAce"
   0x0182  0x0002DBBB "RtlAddAccessDeniedAce"
   0x0183  0x0005AA17 "RtlAddAccessDeniedAceEx"
   0x0184  0x0005AAC0 "RtlAddAccessDeniedObjectAce"
   0x0185  0x0002B550 "RtlAddAce"
   0x0186  0x0002E88D "RtlAddActionToRXact"
   0x0187  0x000346FA "RtlAddAtomToAtomTable"
   0x0188  0x0002E62E "RtlAddAttributeActionToRXact"
   0x0189  0x0002FFFD "RtlAddAuditAccessAce"
   0x018A  0x0005AA3B "RtlAddAuditAccessAceEx"
   0x018B  0x0005AB0E "RtlAddAuditAccessObjectAce"
   0x018C  0x0005A7D3 "RtlAddCompoundAce"
   0x018D  0x0005BA66 "RtlAddRange"
   0x018E  0x0000FBB2 "RtlAddRefActivationContext"
   0x018F  0x00020581 "RtlAddRefMemoryStream"
   0x0190  0x00036BFA "RtlAddVectoredExceptionHandler"
   0x0191  0x00012885 "RtlAddressInSectionTable"
   0x0192  0x00029A4D "RtlAdjustPrivilege"
   0x0193  0x0001886B "RtlAllocateAndInitializeSid"
   0x0194  0x00019374 "RtlAllocateHandle"
   0x0195  0x000100A4 "RtlAllocateHeap"
   0x0196  0x00018179 "RtlAnsiCharToUnicodeChar"
   0x0197  0x0005D590 "RtlAnsiStringToUnicodeSize"
   0x0198  0x0000EB1B "RtlAnsiStringToUnicodeString"
   0x0199  0x0005D8FA "RtlAppendAsciizToString"
   0x019A  0x0001D4BD "RtlAppendPathElement"
   0x019B  0x0005D955 "RtlAppendStringToString"
   0x019C  0x00014F8F "RtlAppendUnicodeStringToString"
   0x019D  0x00014F1A "RtlAppendUnicodeToString"
   0x019E  0x000548B5 "RtlApplicationVerifierStop"
   0x019F  0x0002E809 "RtlApplyRXact"
   0x01A0  0x0002EDC0 "RtlApplyRXactNoFlush"
   0x01A1  0x0002A02B "RtlAreAllAccessesGranted"
   0x01A2  0x000380F4 "RtlAreAnyAccessesGranted"
   0x01A3  0x0005DF7F "RtlAreBitsClear"
   0x01A4  0x000266E7 "RtlAreBitsSet"
   0x01A5  0x0005E353 "RtlAssert2"
   0x01A6  0x0005E561 "RtlAssert"
   0x01A7  0x0005E7A9 "RtlCancelTimer"
   0x01A8  0x0000331A "RtlCaptureContext"
   0x01A9  0x0005EA69 "RtlCaptureStackBackTrace"
   0x01AA  0x0005E969 "RtlCaptureStackContext"
   0x01AB  0x00033B90 "RtlCharToInteger"
   0x01AC  0x00013A93 "RtlCheckForOrphanedCriticalSections"
   0x01AD  0x00030197 "RtlCheckProcessParameters"
   0x01AE  0x0002FA83 "RtlCheckRegistryKey"
   0x01AF  0x0002C19B "RtlClearAllBits"
   0x01B0  0x000266A1 "RtlClearBits"
   0x01B1  0x000518D0 "RtlCloneMemoryStream"
   0x01B2  0x000518D0 "RtlCommitMemoryStream"
   0x01B3  0x000361A7 "RtlCompactHeap"
   0x01B4  0x00002B53 "RtlCompareMemory"
   0x01B5  0x00002BA3 "RtlCompareMemoryUlong"
   0x01B6  0x0005D81E "RtlCompareString"
   0x01B7  0x00017988 "RtlCompareUnicodeString"
   0x01B8  0x00060B65 "RtlCompressBuffer"
   0x01B9  0x00060DA9 "RtlComputeCrc32"
   0x01BA  0x0005789F "RtlComputeImportTableHash"
   0x01BB  0x000514CB "RtlComputePrivatizedDllName_U"
   0x01BC  0x00024E85 "RtlConsoleMultiByteToUnicodeN"
   0x01BD  0x0002CBE0 "RtlConvertExclusiveToShared"
   0x01BE  0x00003236 "RtlConvertLongToLargeInteger"
   0x01BF  0x0002CB9E "RtlConvertSharedToExclusive"
   0x01C0  0x00014C35 "RtlConvertSidToUnicodeString"
   0x01C1  0x00051E90 "RtlConvertToAutoInheritSecurityObject"
   0x01C2  0x000521A2 "RtlConvertUiListToApiList"
   0x01C3  0x0000323E "RtlConvertUlongToLargeInteger"
   0x01C4  0x0001312C "RtlCopyLuid"
   0x01C5  0x0005BE8E "RtlCopyLuidAndAttributesArray"
   0x01C6  0x0005185C "RtlCopyMemoryStreamTo"
   0x01C7  0x0005184F "RtlCopyOutOfProcessMemoryStreamTo"
   0x01C8  0x0005B27D "RtlCopyRangeList"
   0x01C9  0x0002C3B4 "RtlCopySecurityDescriptor"
   0x01CA  0x0001314A "RtlCopySid"
   0x01CB  0x0005BDD1 "RtlCopySidAndAttributesArray"
   0x01CC  0x0002D1AE "RtlCopyString"
   0x01CD  0x00014EB9 "RtlCopyUnicodeString"
   0x01CE  0x000187C9 "RtlCreateAcl"
   0x01CF  0x00020AB5 "RtlCreateActivationContext"
   0x01D0  0x0002EEB9 "RtlCreateAndSetSD"
   0x01D1  0x000348EA "RtlCreateAtomTable"
   0x01D2  0x000611E5 "RtlCreateBootStatusDataFile"
   0x01D3  0x0002CA69 "RtlCreateEnvironment"
   0x01D4  0x00025C62 "RtlCreateHeap"
   0x01D5  0x00022E79 "RtlCreateProcessParameters"
   0x01D6  0x00052740 "RtlCreateQueryDebugBuffer"
   0x01D7  0x0005EFB8 "RtlCreateRegistryKey"
   0x01D8  0x00018631 "RtlCreateSecurityDescriptor"
   0x01D9  0x000619B1 "RtlCreateSystemVolumeInformationFolder"
   0x01DA  0x00022234 "RtlCreateTagHeap"
   0x01DB  0x0002CD30 "RtlCreateTimer"
   0x01DC  0x0002DAD3 "RtlCreateTimerQueue"
   0x01DD  0x00013412 "RtlCreateUnicodeString"
   0x01DE  0x00013059 "RtlCreateUnicodeStringFromAsciiz"
   0x01DF  0x0003057B "RtlCreateUserProcess"
   0x01E0  0x0002EE41 "RtlCreateUserSecurityObject"
   0x01E1  0x0002DF6A "RtlCreateUserThread"
   0x01E2  0x0005971E "RtlCustomCPToUnicodeN"
   0x01E3  0x00031A4D "RtlCutoverTimeToSystemTime"
   0x01E4  0x00022DCB "RtlDeNormalizeProcessParams"
   0x01E5  0x000178BF "RtlDeactivateActivationContext"
   0x01E6  0x000011DD "RtlDeactivateActivationContextUnsafeFast"
   0x01E7  0x0005E5C4 "RtlDebugPrintTimes"
   0x01E8  0x00013405 "RtlDecodePointer"
   0x01E9  0x00018A78 "RtlDecodeSystemPointer"
   0x01EA  0x00060BE1 "RtlDecompressBuffer"
   0x01EB  0x00060C4D "RtlDecompressFragment"
   0x01EC  0x00051EA0 "RtlDefaultNpAcl"
   0x01ED  0x00024CC1 "RtlDelete"
   0x01EE  0x00038121 "RtlDeleteAce"
   0x01EF  0x0003404E "RtlDeleteAtomFromAtomTable"
   0x01F0  0x0001135A "RtlDeleteCriticalSection"
   0x01F1  0x00024C60 "RtlDeleteElementGenericTable"
   0x01F2  0x00062304 "RtlDeleteElementGenericTableAvl"
   0x01F3  0x00061D1C "RtlDeleteNoSplay"
   0x01F4  0x0005BC2E "RtlDeleteOwnersRanges"
   0x01F5  0x0005BAF1 "RtlDeleteRange"
   0x01F6  0x00030FCC "RtlDeleteRegistryValue"
   0x01F7  0x00023CDB "RtlDeleteResource"
   0x01F8  0x0002A1C3 "RtlDeleteSecurityObject"
   0x01F9  0x00033432 "RtlDeleteTimer"
   0x01FA  0x0005E781 "RtlDeleteTimerQueue"
   0x01FB  0x0005E679 "RtlDeleteTimerQueueEx"
   0x01FC  0x000315AA "RtlDeregisterWait"
   0x01FD  0x00031282 "RtlDeregisterWaitEx"
   0x01FE  0x0005ABA2 "RtlDestroyAtomTable"
   0x01FF  0x00023942 "RtlDestroyEnvironment"
   0x0200  0x00023B25 "RtlDestroyHandleTable"
   0x0201  0x000264CE "RtlDestroyHeap"
   0x0202  0x00022DA4 "RtlDestroyProcessParameters"
   0x0203  0x00052828 "RtlDestroyQueryDebugBuffer"
   0x0204  0x00013B6A "RtlDetermineDosPathNameType_U"
   0x0205  0x000136B0 "RtlDllShutdownInProgress"
   0x0206  0x00030EA3 "RtlDnsHostNameToComputerName"
   0x0207  0x000199B8 "RtlDoesFileExists_U"
   0x0208  0x0001597B "RtlDosApplyFileIsolationRedirection_Ustr"
   0x0209  0x000142D5 "RtlDosPathNameToNtPathName_U"
   0x020A  0x00016FD9 "RtlDosSearchPath_U"
   0x020B  0x00018BF1 "RtlDosSearchPath_Ustr"
   0x020C  0x0005D50E "RtlDowncaseUnicodeChar"
   0x020D  0x00029AFA "RtlDowncaseUnicodeString"
   0x020E  0x000518F4 "RtlDumpResource"
   0x020F  0x00020F1B "RtlDuplicateUnicodeString"
   0x0210  0x0005AC79 "RtlEmptyAtomTable"
   0x0211  0x000519AD "RtlEnableEarlyCriticalSectionEventCreation"
   0x0212  0x000133DF "RtlEncodePointer"
   0x0213  0x00018A78 "RtlEncodeSystemPointer"
   0x0214  0x00003016 "RtlEnlargedIntegerMultiply"
   0x0215  0x0000302E "RtlEnlargedUnsignedDivide"
   0x0216  0x00003022 "RtlEnlargedUnsignedMultiply"
   0x0217  0x00001000 "RtlEnterCriticalSection"
   0x0218  0x0005F951 "RtlEnumProcessHeaps"
   0x0219  0x00061E25 "RtlEnumerateGenericTable"
   0x021A  0x00030034 "RtlEnumerateGenericTableAvl"
   0x021B  0x0006238E "RtlEnumerateGenericTableLikeADirectory"
   0x021C  0x0001E2F4 "RtlEnumerateGenericTableWithoutSplaying"
   0x021D  0x00030059 "RtlEnumerateGenericTableWithoutSplayingAvl"
   0x021E  0x0005D80E "RtlEqualComputerName"
   0x021F  0x0002B436 "RtlEqualDomainName"
   0x0220  0x0005BE65 "RtlEqualLuid"
   0x0221  0x00032F64 "RtlEqualPrefixSid"
   0x0222  0x0001822C "RtlEqualSid"
   0x0223  0x000135B6 "RtlEqualString"
   0x0224  0x00012E9B "RtlEqualUnicodeString"
   0x0225  0x0002EDFE "RtlEraseUnicodeString"
   0x0226  0x0006149B "RtlExitUserThread"
   0x0227  0x000146AA "RtlExpandEnvironmentStrings_U"
   0x0228  0x0005F691 "RtlExtendHeap"
   0x0229  0x0000313A "RtlExtendedIntegerMultiply"
   0x022A  0x0000304E "RtlExtendedLargeIntegerDivide"
   0x022B  0x000030AA "RtlExtendedMagicDivide"
   0x022C  0x00002BD3 "RtlFillMemory"
   0x022D  0x00002C43 "RtlFillMemoryUlong"
   0x022E  0x00020E1E "RtlFinalReleaseOutOfProcessMemoryStream"
   0x022F  0x00028CEE "RtlFindActivationContextSectionGuid"
   0x0230  0x000154F1 "RtlFindActivationContextSectionString"
   0x0231  0x00015D41 "RtlFindCharInUnicodeString"
   0x0232  0x0002633D "RtlFindClearBits"
   0x0233  0x00026405 "RtlFindClearBitsAndSet"
   0x0234  0x0005DC5A "RtlFindClearRuns"
   0x0235  0x0005E0FC "RtlFindLastBackwardRunClear"
   0x0236  0x0005E277 "RtlFindLeastSignificantBit"
   0x0237  0x0005DEA1 "RtlFindLongestRunClear"
   0x0238  0x00034FF9 "RtlFindMessage"
   0x0239  0x0005E1CC "RtlFindMostSignificantBit"
   0x023A  0x0005E002 "RtlFindNextForwardRunClear"
   0x023B  0x0005B3D0 "RtlFindRange"
   0x023C  0x0005D9A9 "RtlFindSetBits"
   0x023D  0x0005E320 "RtlFindSetBitsAndClear"
   0x023E  0x00002AF8 "RtlFirstEntrySList"
   0x023F  0x000186BA "RtlFirstFreeAce"
   0x0240  0x000624BA "RtlFlushSecureMemoryCache"
   0x0241  0x00014FF9 "RtlFormatCurrentUserKeyPath"
   0x0242  0x000293C4 "RtlFormatMessage"
   0x0243  0x00010446 "RtlFreeAnsiString"
   0x0244  0x0001331F "RtlFreeHandle"
   0x0245  0x0000FF0D "RtlFreeHeap"
   0x0246  0x0002B493 "RtlFreeOemString"
   0x0247  0x0005B014 "RtlFreeRangeList"
   0x0248  0x0001883E "RtlFreeSid"
   0x0249  0x0001390D "RtlFreeThreadActivationContextStack"
   0x024A  0x00010446 "RtlFreeUnicodeString"
   0x024B  0x000614C5 "RtlFreeUserThreadStack"
   0x024C  0x00026C80 "RtlGUIDFromString"
   0x024D  0x00062928 "RtlGenerate8dot3Name"
   0x024E  0x00034EB9 "RtlGetAce"
   0x024F  0x0001C5AB "RtlGetActiveActivationContext"
   0x0250  0x0005EB22 "RtlGetCallersAddress"
   0x0251  0x00060AF9 "RtlGetCompressionWorkSpaceSize"
   0x0252  0x0002A195 "RtlGetControlSecurityDescriptor"
   0x0253  0x000144E6 "RtlGetCurrentDirectory_U"
   0x0254  0x0005EFA9 "RtlGetCurrentPeb"
   0x0255  0x0001377F "RtlGetDaclSecurityDescriptor"
   0x0256  0x00061D9C "RtlGetElementGenericTable"
   0x0257  0x0006218F "RtlGetElementGenericTableAvl"
   0x0258  0x0005B059 "RtlGetFirstRange"
   0x0259  0x00020481 "RtlGetFrame"
   0x025A  0x00014389 "RtlGetFullPathName_U"
   0x025B  0x0002B3F7 "RtlGetGroupSecurityDescriptor"
   0x025C  0x00062D15 "RtlGetLastNtStatus"
   0x025D  0x0000FE01 "RtlGetLastWin32Error"
   0x025E  0x00020759 "RtlGetLengthWithoutLastFullDosOrNtPathElement"
   0x025F  0x0002F2DD "RtlGetLengthWithoutTrailingPathSeperators"
   0x0260  0x000149B9 "RtlGetLongestNtPathLength"
   0x0261  0x0000D910 "RtlGetNativeSystemInformation"
   0x0262  0x0005B111 "RtlGetNextRange"
   0x0263  0x0000FEFB "RtlGetNtGlobalFlags"
   0x0264  0x00019738 "RtlGetNtProductType"
   0x0265  0x0002130F "RtlGetNtVersionNumbers"
   0x0266  0x0002B3B5 "RtlGetOwnerSecurityDescriptor"
   0x0267  0x0005F899 "RtlGetProcessHeaps"
   0x0268  0x0005BEBD "RtlGetSaclSecurityDescriptor"
   0x0269  0x0005C118 "RtlGetSecurityDescriptorRMControl"
   0x026A  0x00030411 "RtlGetSetBootStatusData"
   0x026B  0x0005069B "RtlGetUnloadEventTrace"
   0x026C  0x00013842 "RtlGetUserInfoHeap"
   0x026D  0x0001964B "RtlGetVersion"
   0x026E  0x0001563D "RtlHashUnicodeString"
   0x026F  0x0002A24C "RtlIdentifierAuthoritySid"
   0x0270  0x00010326 "RtlImageDirectoryEntryToData"
   0x0271  0x00010319 "RtlImageNtHeader"
   0x0272  0x000128B7 "RtlImageRvaToSection"
   0x0273  0x00030B3A "RtlImageRvaToVa"
   0x0274  0x00029D87 "RtlImpersonateSelf"
   0x0275  0x0000125D "RtlInitAnsiString"
   0x0276  0x00022656 "RtlInitCodePageTable"
   0x0277  0x00021514 "RtlInitMemoryStream"
   0x0278  0x00022625 "RtlInitNlsTables"
   0x0279  0x000209D2 "RtlInitOutOfProcessMemoryStream"
   0x027A  0x00001225 "RtlInitString"
   0x027B  0x00001295 "RtlInitUnicodeString"
   0x027C  0x0000FE75 "RtlInitUnicodeStringEx"
   0x027D  0x0002221C "RtlInitializeAtomPackage"
   0x027E  0x00018A5C "RtlInitializeBitMap"
   0x027F  0x0002E0A9 "RtlInitializeContext"
   0x0280  0x000115FD "RtlInitializeCriticalSection"
   0x0281  0x000114FA "RtlInitializeCriticalSectionAndSpinCount"
   0x0282  0x00021491 "RtlInitializeGenericTable"
   0x0283  0x00030161 "RtlInitializeGenericTableAvl"
   0x0284  0x00018B7A "RtlInitializeHandleTable"
   0x0285  0x0002FE1A "RtlInitializeRXact"
   0x0286  0x0005ADF9 "RtlInitializeRangeList"
   0x0287  0x0001E6DF "RtlInitializeResource"
   0x0288  0x00034F93 "RtlInitializeSListHead"
   0x0289  0x00018275 "RtlInitializeSid"
   0x028A  0x00062F97 "RtlInitializeStackTraceDataBase"
   0x028B  0x00024A1F "RtlInsertElementGenericTable"
   0x028C  0x000622D1 "RtlInsertElementGenericTableAvl"
   0x028D  0x0005EF39 "RtlInt64ToUnicodeString"
   0x028E  0x0001ACE8 "RtlIntegerToChar"
   0x028F  0x0001AE0E "RtlIntegerToUnicodeString"
   0x0290  0x00062EB5 "RtlInterlockedFlushSList"
   0x0291  0x00033C83 "RtlInterlockedPopEntrySList"
   0x0292  0x00033C41 "RtlInterlockedPushEntrySList"
   0x0293  0x0005BCDF "RtlInvertRangeList"
   0x0294  0x0006347B "RtlIpv4AddressToStringA"
   0x0295  0x000634C9 "RtlIpv4AddressToStringExA"
   0x0296  0x0002D952 "RtlIpv4AddressToStringExW"
   0x0297  0x0002D9CA "RtlIpv4AddressToStringW"
   0x0298  0x0002C951 "RtlIpv4StringToAddressA"
   0x0299  0x00063E27 "RtlIpv4StringToAddressExA"
   0x029A  0x00036B6F "RtlIpv4StringToAddressExW"
   0x029B  0x00035A64 "RtlIpv4StringToAddressW"
   0x029C  0x00063169 "RtlIpv6AddressToStringA"
   0x029D  0x00063395 "RtlIpv6AddressToStringExA"
   0x029E  0x000637D7 "RtlIpv6AddressToStringExW"
   0x029F  0x0006356F "RtlIpv6AddressToStringW"
   0x02A0  0x000638CB "RtlIpv6StringToAddressA"
   0x02A1  0x00063BEA "RtlIpv6StringToAddressExA"
   0x02A2  0x000642BE "RtlIpv6StringToAddressExW"
   0x02A3  0x00063FC0 "RtlIpv6StringToAddressW"
   0x02A4  0x000562C6 "RtlIsActivationContextActive"
   0x02A5  0x00013088 "RtlIsDosDeviceName_U"
   0x02A6  0x0001E36C "RtlIsGenericTableEmpty"
   0x02A7  0x00062176 "RtlIsGenericTableEmptyAvl"
   0x02A8  0x000627A7 "RtlIsNameLegalDOS8Dot3"
   0x02A9  0x0005B753 "RtlIsRangeAvailable"
   0x02AA  0x0002904B "RtlIsTextUnicode"
   0x02AB  0x00050C91 "RtlIsThreadWithinLoaderCallout"
   0x02AC  0x000132BD "RtlIsValidHandle"
   0x02AD  0x000133AE "RtlIsValidIndexHandle"
   0x02AE  0x00003002 "RtlLargeIntegerAdd"
   0x02AF  0x000031E2 "RtlLargeIntegerArithmeticShift"
   0x02B0  0x00064521 "RtlLargeIntegerDivide"
   0x02B1  0x0000320E "RtlLargeIntegerNegate"
   0x02B2  0x00003192 "RtlLargeIntegerShiftLeft"
   0x02B3  0x000031BA "RtlLargeIntegerShiftRight"
   0x02B4  0x00003222 "RtlLargeIntegerSubtract"
   0x02B5  0x0005EB6C "RtlLargeIntegerToChar"
   0x02B6  0x000010E0 "RtlLeaveCriticalSection"
   0x02B7  0x00013698 "RtlLengthRequiredSid"
   0x02B8  0x0002B29B "RtlLengthSecurityDescriptor"
   0x02B9  0x0001317E "RtlLengthSid"
   0x02BA  0x00061C80 "RtlLocalTimeToSystemTime"
   0x02BB  0x000302B3 "RtlLockBootStatusData"
   0x02BC  0x000131EB "RtlLockHeap"
   0x02BD  0x0005184F "RtlLockMemoryStreamRegion"
   0x02BE  0x000115B4 "RtlLogStackBackTrace"
   0x02BF  0x0002848A "RtlLookupAtomInAtomTable"
   0x02C0  0x0002100F "RtlLookupElementGenericTable"
   0x02C1  0x0006245D "RtlLookupElementGenericTableAvl"
   0x02C2  0x0002992F "RtlMakeSelfRelativeSD"
   0x02C3  0x00029FDD "RtlMapGenericMask"
   0x02C4  0x0005C1A5 "RtlMapSecurityErrorToNtStatus"
   0x02C5  0x0005B986 "RtlMergeRangeLists"
   0x02C6  0x00002C94 "RtlMoveMemory"
   0x02C7  0x000168F5 "RtlMultiAppendUnicodeStringBuffer"
   0x02C8  0x0000EC9A "RtlMultiByteToUnicodeN"
   0x02C9  0x0002937A "RtlMultiByteToUnicodeSize"
   0x02CA  0x00051CBC "RtlNewInstanceSecurityObject"
   0x02CB  0x00051D32 "RtlNewSecurityGrantedAccess"
   0x02CC  0x0002E927 "RtlNewSecurityObject"
   0x02CD  0x000326F0 "RtlNewSecurityObjectEx"
   0x02CE  0x00051A81 "RtlNewSecurityObjectWithMultipleInheritance"
   0x02CF  0x00022316 "RtlNormalizeProcessParams"
   0x02D0  0x000243FC "RtlNtPathNameToDosPathName"
   0x02D1  0x0000F60D "RtlNtStatusToDosError"
   0x02D2  0x0000F659 "RtlNtStatusToDosErrorNoTeb"
   0x02D3  0x00023B59 "RtlNumberGenericTableElements"
   0x02D4  0x00062264 "RtlNumberGenericTableElementsAvl"
   0x02D5  0x0005DED8 "RtlNumberOfClearBits"
   0x02D6  0x0005DF28 "RtlNumberOfSetBits"
   0x02D7  0x0005D590 "RtlOemStringToUnicodeSize"
   0x02D8  0x00027465 "RtlOemStringToUnicodeString"
   0x02D9  0x0002733C "RtlOemToUnicodeN"
   0x02DA  0x00018AB9 "RtlOpenCurrentUser"
   0x02DB  0x00034363 "RtlPcToFileHeader"
   0x02DC  0x0005AD41 "RtlPinAtomInAtomTable"
   0x02DD  0x00019AC0 "RtlPopFrame"
   0x02DE  0x0002DC25 "RtlPrefixString"
   0x02DF  0x000143E8 "RtlPrefixUnicodeString"
   0x02E0  0x0005F27A "RtlProtectHeap"
   0x02E1  0x00019AE0 "RtlPushFrame"
   0x02E2  0x0003498D "RtlQueryAtomInAtomTable"
   0x02E3  0x00033CF0 "RtlQueryDepthSList"
   0x02E4  0x00014579 "RtlQueryEnvironmentVariable_U"
   0x02E5  0x00060263 "RtlQueryHeapInformation"
   0x02E6  0x0002CEA5 "RtlQueryInformationAcl"
   0x02E7  0x0000FCB2 "RtlQueryInformationActivationContext"
   0x02E8  0x00013591 "RtlQueryInformationActiveActivationContext"
   0x02E9  0x0002059D "RtlQueryInterfaceMemoryStream"
   0x02EA  0x00052909 "RtlQueryProcessBackTraceInformation"
   0x02EB  0x00053153 "RtlQueryProcessDebugInformation"
   0x02EC  0x00052AB1 "RtlQueryProcessHeapInformation"
   0x02ED  0x00052FDD "RtlQueryProcessLockInformation"
   0x02EE  0x0002F3CE "RtlQueryRegistryValues"
   0x02EF  0x00051ABA "RtlQuerySecurityObject"
   0x02F0  0x0005F52D "RtlQueryTagHeap"
   0x02F1  0x0005F039 "RtlQueryTimeZoneInformation"
   0x02F2  0x00056265 "RtlQueueApcWow64Thread"
   0x02F3  0x00027C38 "RtlQueueWorkItem"
   0x02F4  0x0000E508 "RtlRaiseException"
   0x02F5  0x00064768 "RtlRaiseStatus"
   0x02F6  0x00064797 "RtlRandom"
   0x02F7  0x00037D08 "RtlRandomEx"
   0x02F8  0x00019B80 "RtlReAllocateHeap"
   0x02F9  0x000214CF "RtlReadMemoryStream"
   0x02FA  0x0002051F "RtlReadOutOfProcessMemoryStream"
   0x02FB  0x00061CDF "RtlRealPredecessor"
   0x02FC  0x0001E32B "RtlRealSuccessor"
   0x02FD  0x0006247E "RtlRegisterSecureMemoryCacheCallback"
   0x02FE  0x00033203 "RtlRegisterWait"
   0x02FF  0x00010527 "RtlReleaseActivationContext"
   0x0300  0x0002032F "RtlReleaseMemoryStream"
   0x0301  0x00010431 "RtlReleasePebLock"
   0x0302  0x00029F64 "RtlReleaseResource"
   0x0303  0x00062D48 "RtlRemoteCall"
   0x0304  0x00036C66 "RtlRemoveVectoredExceptionHandler"
   0x0305  0x000224DB "RtlResetRtlTranslations"
   0x0306  0x0000FE10 "RtlRestoreLastWin32Error"
   0x0307  0x000518DD "RtlRevertMemoryStream"
   0x0308  0x0002D7B3 "RtlRunDecodeUnicodeString"
   0x0309  0x0002D765 "RtlRunEncodeUnicodeString"
   0x030A  0x00061C49 "RtlSecondsSince1970ToTime"
   0x030B  0x00061C12 "RtlSecondsSince1980ToTime"
   0x030C  0x000517E0 "RtlSeekMemoryStream"
   0x030D  0x0005A708 "RtlSelfRelativeToAbsoluteSD2"
   0x030E  0x0002CFA7 "RtlSelfRelativeToAbsoluteSD"
   0x030F  0x0002C1CC "RtlSetAllBits"
   0x0310  0x0005C290 "RtlSetAttributesSecurityDescriptor"
   0x0311  0x00026438 "RtlSetBits"
   0x0312  0x0002FAB0 "RtlSetControlSecurityDescriptor"
   0x0313  0x0002A047 "RtlSetCriticalSectionSpinCount"
   0x0314  0x0001E78E "RtlSetCurrentDirectory_U"
   0x0315  0x000613BD "RtlSetCurrentEnvironment"
   0x0316  0x0001865F "RtlSetDaclSecurityDescriptor"
   0x0317  0x00027798 "RtlSetEnvironmentVariable"
   0x0318  0x00018A12 "RtlSetGroupSecurityDescriptor"
   0x0319  0x00037CB5 "RtlSetHeapInformation"
   0x031A  0x0005A787 "RtlSetInformationAcl"
   0x031B  0x0002DD69 "RtlSetIoCompletionCallback"
   0x031C  0x0000FE10 "RtlSetLastWin32Error"
   0x031D  0x00062D27 "RtlSetLastWin32ErrorAndNtStatusFromNtStatus"
   0x031E  0x00051842 "RtlSetMemoryStreamSize"
   0x031F  0x000189C8 "RtlSetOwnerSecurityDescriptor"
   0x0320  0x0002EB6C "RtlSetProcessIsCritical"
   0x0321  0x0002CF16 "RtlSetSaclSecurityDescriptor"
   0x0322  0x0005C17A "RtlSetSecurityDescriptorRMControl"
   0x0323  0x0002C46C "RtlSetSecurityObject"
   0x0324  0x00051A91 "RtlSetSecurityObjectEx"
   0x0325  0x0002EBC0 "RtlSetThreadIsCritical"
   0x0326  0x00022279 "RtlSetThreadPoolStartFunc"
   0x0327  0x0005F161 "RtlSetTimeZoneInformation"
   0x0328  0x0005E799 "RtlSetTimer"
   0x0329  0x00057F91 "RtlSetUnicodeCallouts"
   0x032A  0x0005F3DD "RtlSetUserFlagsHeap"
   0x032B  0x000193C9 "RtlSetUserValueHeap"
   0x032C  0x000104BD "RtlSizeHeap"
   0x032D  0x00020EB8 "RtlSplay"
   0x032E  0x0002B130 "RtlStartRXact"
   0x032F  0x00020A35 "RtlStatMemoryStream"
   0x0330  0x00028E96 "RtlStringFromGUID"
   0x0331  0x000136C0 "RtlSubAuthorityCountSid"
   0x0332  0x00018258 "RtlSubAuthoritySid"
   0x0333  0x00024C3D "RtlSubtreePredecessor"
   0x0334  0x00061CBC "RtlSubtreeSuccessor"
   0x0335  0x00035A28 "RtlSystemTimeToLocalTime"
   0x0336  0x0001AB19 "RtlTimeFieldsToTime"
   0x0337  0x00061BAB "RtlTimeToElapsedTimeFields"
   0x0338  0x0002B1C3 "RtlTimeToSecondsSince1970"
   0x0339  0x0002A144 "RtlTimeToSecondsSince1980"
   0x033A  0x00011EDD "RtlTimeToTimeFields"
   0x033B  0x00064E17 "RtlTraceDatabaseAdd"
   0x033C  0x00064A4A "RtlTraceDatabaseCreate"
   0x033D  0x00064B3C "RtlTraceDatabaseDestroy"
   0x033E  0x000649C2 "RtlTraceDatabaseEnumerate"
   0x033F  0x00064C23 "RtlTraceDatabaseFind"
   0x0340  0x00064DF7 "RtlTraceDatabaseLock"
   0x0341  0x00064E07 "RtlTraceDatabaseUnlock"
   0x0342  0x00064BD9 "RtlTraceDatabaseValidate"
   0x0343  0x00001118 "RtlTryEnterCriticalSection"
   0x0344  0x00065029 "RtlUnhandledExceptionFilter2"
   0x0345  0x000659AF "RtlUnhandledExceptionFilter"
   0x0346  0x0005D56B "RtlUnicodeStringToAnsiSize"
   0x0347  0x00012B98 "RtlUnicodeStringToAnsiString"
   0x0348  0x0005D666 "RtlUnicodeStringToCountedOemString"
   0x0349  0x0001AE71 "RtlUnicodeStringToInteger"
   0x034A  0x0005D56B "RtlUnicodeStringToOemSize"
   0x034B  0x000271EA "RtlUnicodeStringToOemString"
   0x034C  0x00059902 "RtlUnicodeToCustomCPN"
   0x034D  0x00012A6D "RtlUnicodeToMultiByteN"
   0x034E  0x0001319A "RtlUnicodeToMultiByteSize"
   0x034F  0x000270C8 "RtlUnicodeToOemN"
   0x0350  0x0002EC01 "RtlUniform"
   0x0351  0x000303CB "RtlUnlockBootStatusData"
   0x0352  0x00013253 "RtlUnlockHeap"
   0x0353  0x0005184F "RtlUnlockMemoryStreamRegion"
   0x0354  0x0002ABA5 "RtlUnwind"
   0x0355  0x000103C0 "RtlUpcaseUnicodeChar"
   0x0356  0x00026B63 "RtlUpcaseUnicodeString"
   0x0357  0x0005D5B7 "RtlUpcaseUnicodeStringToAnsiString"
   0x0358  0x0005D73A "RtlUpcaseUnicodeStringToCountedOemString"
   0x0359  0x0002C099 "RtlUpcaseUnicodeStringToOemString"
   0x035A  0x00059AB1 "RtlUpcaseUnicodeToCustomCPN"
   0x035B  0x000241BD "RtlUpcaseUnicodeToMultiByteN"
   0x035C  0x0002BD75 "RtlUpcaseUnicodeToOemN"
   0x035D  0x0002AE3D "RtlUpdateTimer"
   0x035E  0x000293A2 "RtlUpperChar"
   0x035F  0x0005D8B1 "RtlUpperString"
   0x0360  0x000605A0 "RtlUsageHeap"
   0x0361  0x000185AD "RtlValidAcl"
   0x0362  0x0002D1F9 "RtlValidRelativeSecurityDescriptor"
   0x0363  0x00034DE2 "RtlValidSecurityDescriptor"
   0x0364  0x00012F64 "RtlValidSid"
   0x0365  0x000602D0 "RtlValidateHeap"
   0x0366  0x000604F3 "RtlValidateProcessHeaps"
   0x0367  0x00015E4A "RtlValidateUnicodeString"
   0x0368  0x00034AC7 "RtlVerifyVersionInfo"
   0x0369  0x0005E7F2 "RtlWalkFrameChain"
   0x036A  0x0005F9D9 "RtlWalkHeap"
   0x036B  0x000517D3 "RtlWriteMemoryStream"
   0x036C  0x00030F70 "RtlWriteRegistryValue"
   0x036D  0x0005D25F "RtlZeroHeap"
   0x036E  0x00002C64 "RtlZeroMemory"
   0x036F  0x00056275 "RtlZombifyActivationContext"
   0x0370  0x000204B6 "RtlpApplyLengthFunction"
   0x0371  0x0001E267 "RtlpEnsureBufferSize"
   0x0372  0x000519C0 "RtlpNotOwnerCriticalSection"
   0x0373  0x00065A73 "RtlpNtCreateKey"
   0x0374  0x0002E571 "RtlpNtEnumerateSubKey"
   0x0375  0x00065ACC "RtlpNtMakeTemporaryKey"
   0x0376  0x00029847 "RtlpNtOpenKey"
   0x0377  0x00029786 "RtlpNtQueryValueKey"
   0x0378  0x00065AA0 "RtlpNtSetValueKey"
   0x0379  0x0001B267 "RtlpUnWaitCriticalSection"
   0x037A  0x0001B19F "RtlpWaitForCriticalSection"
   0x037B  0x0005D590 "RtlxAnsiStringToUnicodeSize"
   0x037C  0x0005D590 "RtlxOemStringToUnicodeSize"
   0x037D  0x0005D56B "RtlxUnicodeStringToAnsiSize"
   0x037E  0x0005D56B "RtlxUnicodeStringToOemSize"
   0x037F  0x00034A89 "VerSetConditionMask"
   0x0380  0x0000CE40 "ZwAcceptConnectPort"
   0x0381  0x0000CE50 "ZwAccessCheck"
   0x0382  0x0000CE60 "ZwAccessCheckAndAuditAlarm"
   0x0383  0x0000CE70 "ZwAccessCheckByType"
   0x0384  0x0000CE80 "ZwAccessCheckByTypeAndAuditAlarm"
   0x0385  0x0000CE90 "ZwAccessCheckByTypeResultList"
   0x0386  0x0000CEA0 "ZwAccessCheckByTypeResultListAndAuditAlarm"
   0x0387  0x0000CEB0 "ZwAccessCheckByTypeResultListAndAuditAlarmByHandle"
   0x0388  0x0000CEC0 "ZwAddAtom"
   0x0389  0x0000CED0 "ZwAddBootEntry"
   0x038A  0x0000CEE0 "ZwAdjustGroupsToken"
   0x038B  0x0000CEF0 "ZwAdjustPrivilegesToken"
   0x038C  0x0000CF00 "ZwAlertResumeThread"
   0x038D  0x0000CF10 "ZwAlertThread"
   0x038E  0x0000CF20 "ZwAllocateLocallyUniqueId"
   0x038F  0x0000CF30 "ZwAllocateUserPhysicalPages"
   0x0390  0x0000CF40 "ZwAllocateUuids"
   0x0391  0x0000CF50 "ZwAllocateVirtualMemory"
   0x0392  0x0000CF60 "ZwAreMappedFilesTheSame"
   0x0393  0x0000CF70 "ZwAssignProcessToJobObject"
   0x0394  0x0000CF80 "ZwCallbackReturn"
   0x0395  0x0000CF90 "ZwCancelDeviceWakeupRequest"
   0x0396  0x0000CFA0 "ZwCancelIoFile"
   0x0397  0x0000CFB0 "ZwCancelTimer"
   0x0398  0x0000CFC0 "ZwClearEvent"
   0x0399  0x0000CFD0 "ZwClose"
   0x039A  0x0000CFE0 "ZwCloseObjectAuditAlarm"
   0x039B  0x0000CFF0 "ZwCompactKeys"
   0x039C  0x0000D000 "ZwCompareTokens"
   0x039D  0x0000D010 "ZwCompleteConnectPort"
   0x039E  0x0000D020 "ZwCompressKey"
   0x039F  0x0000D030 "ZwConnectPort"
   0x03A0  0x0000D040 "ZwContinue"
   0x03A1  0x0000D050 "ZwCreateDebugObject"
   0x03A2  0x0000D060 "ZwCreateDirectoryObject"
   0x03A3  0x0000D070 "ZwCreateEvent"
   0x03A4  0x0000D080 "ZwCreateEventPair"
   0x03A5  0x0000D090 "ZwCreateFile"
   0x03A6  0x0000D0A0 "ZwCreateIoCompletion"
   0x03A7  0x0000D0B0 "ZwCreateJobObject"
   0x03A8  0x0000D0C0 "ZwCreateJobSet"
   0x03A9  0x0000D0D0 "ZwCreateKey"
   0x03AA  0x0000DFB0 "ZwCreateKeyedEvent"
   0x03AB  0x0000D0E0 "ZwCreateMailslotFile"
   0x03AC  0x0000D0F0 "ZwCreateMutant"
   0x03AD  0x0000D100 "ZwCreateNamedPipeFile"
   0x03AE  0x0000D110 "ZwCreatePagingFile"
   0x03AF  0x0000D120 "ZwCreatePort"
   0x03B0  0x0000D130 "ZwCreateProcess"
   0x03B1  0x0000D140 "ZwCreateProcessEx"
   0x03B2  0x0000D150 "ZwCreateProfile"
   0x03B3  0x0000D160 "ZwCreateSection"
   0x03B4  0x0000D170 "ZwCreateSemaphore"
   0x03B5  0x0000D180 "ZwCreateSymbolicLinkObject"
   0x03B6  0x0000D190 "ZwCreateThread"
   0x03B7  0x0000D1A0 "ZwCreateTimer"
   0x03B8  0x0000D1B0 "ZwCreateToken"
   0x03B9  0x0000D1C0 "ZwCreateWaitablePort"
   0x03BA  0x0000D1D0 "ZwDebugActiveProcess"
   0x03BB  0x0000D1E0 "ZwDebugContinue"
   0x03BC  0x0000D1F0 "ZwDelayExecution"
   0x03BD  0x0000D200 "ZwDeleteAtom"
   0x03BE  0x0000D210 "ZwDeleteBootEntry"
   0x03BF  0x0000D220 "ZwDeleteFile"
   0x03C0  0x0000D230 "ZwDeleteKey"
   0x03C1  0x0000D240 "ZwDeleteObjectAuditAlarm"
   0x03C2  0x0000D250 "ZwDeleteValueKey"
   0x03C3  0x0000D260 "ZwDeviceIoControlFile"
   0x03C4  0x0000D270 "ZwDisplayString"
   0x03C5  0x0000D280 "ZwDuplicateObject"
   0x03C6  0x0000D290 "ZwDuplicateToken"
   0x03C7  0x0000D2A0 "ZwEnumerateBootEntries"
   0x03C8  0x0000D2B0 "ZwEnumerateKey"
   0x03C9  0x0000D2C0 "ZwEnumerateSystemEnvironmentValuesEx"
   0x03CA  0x0000D2D0 "ZwEnumerateValueKey"
   0x03CB  0x0000D2E0 "ZwExtendSection"
   0x03CC  0x0000D2F0 "ZwFilterToken"
   0x03CD  0x0000D300 "ZwFindAtom"
   0x03CE  0x0000D310 "ZwFlushBuffersFile"
   0x03CF  0x0000D320 "ZwFlushInstructionCache"
   0x03D0  0x0000D330 "ZwFlushKey"
   0x03D1  0x0000D340 "ZwFlushVirtualMemory"
   0x03D2  0x0000D350 "ZwFlushWriteBuffer"
   0x03D3  0x0000D360 "ZwFreeUserPhysicalPages"
   0x03D4  0x0000D370 "ZwFreeVirtualMemory"
   0x03D5  0x0000D380 "ZwFsControlFile"
   0x03D6  0x0000D390 "ZwGetContextThread"
   0x03D7  0x0000D3A0 "ZwGetDevicePowerState"
   0x03D8  0x0000D3B0 "ZwGetPlugPlayEvent"
   0x03D9  0x0000D3C0 "ZwGetWriteWatch"
   0x03DA  0x0000D3D0 "ZwImpersonateAnonymousToken"
   0x03DB  0x0000D3E0 "ZwImpersonateClientOfPort"
   0x03DC  0x0000D3F0 "ZwImpersonateThread"
   0x03DD  0x0000D400 "ZwInitializeRegistry"
   0x03DE  0x0000D410 "ZwInitiatePowerAction"
   0x03DF  0x0000D420 "ZwIsProcessInJob"
   0x03E0  0x0000D430 "ZwIsSystemResumeAutomatic"
   0x03E1  0x0000D440 "ZwListenPort"
   0x03E2  0x0000D450 "ZwLoadDriver"
   0x03E3  0x0000D470 "ZwLoadKey2"
   0x03E4  0x0000D460 "ZwLoadKey"
   0x03E5  0x0000D480 "ZwLockFile"
   0x03E6  0x0000D490 "ZwLockProductActivationKeys"
   0x03E7  0x0000D4A0 "ZwLockRegistryKey"
   0x03E8  0x0000D4B0 "ZwLockVirtualMemory"
   0x03E9  0x0000D4C0 "ZwMakePermanentObject"
   0x03EA  0x0000D4D0 "ZwMakeTemporaryObject"
   0x03EB  0x0000D4E0 "ZwMapUserPhysicalPages"
   0x03EC  0x0000D4F0 "ZwMapUserPhysicalPagesScatter"
   0x03ED  0x0000D500 "ZwMapViewOfSection"
   0x03EE  0x0000D510 "ZwModifyBootEntry"
   0x03EF  0x0000D520 "ZwNotifyChangeDirectoryFile"
   0x03F0  0x0000D530 "ZwNotifyChangeKey"
   0x03F1  0x0000D540 "ZwNotifyChangeMultipleKeys"
   0x03F2  0x0000D550 "ZwOpenDirectoryObject"
   0x03F3  0x0000D560 "ZwOpenEvent"
   0x03F4  0x0000D570 "ZwOpenEventPair"
   0x03F5  0x0000D580 "ZwOpenFile"
   0x03F6  0x0000D590 "ZwOpenIoCompletion"
   0x03F7  0x0000D5A0 "ZwOpenJobObject"
   0x03F8  0x0000D5B0 "ZwOpenKey"
   0x03F9  0x0000DFC0 "ZwOpenKeyedEvent"
   0x03FA  0x0000D5C0 "ZwOpenMutant"
   0x03FB  0x0000D5D0 "ZwOpenObjectAuditAlarm"
   0x03FC  0x0000D5E0 "ZwOpenProcess"
   0x03FD  0x0000D5F0 "ZwOpenProcessToken"
   0x03FE  0x0000D600 "ZwOpenProcessTokenEx"
   0x03FF  0x0000D610 "ZwOpenSection"
   0x0400  0x0000D620 "ZwOpenSemaphore"
   0x0401  0x0000D630 "ZwOpenSymbolicLinkObject"
   0x0402  0x0000D640 "ZwOpenThread"
   0x0403  0x0000D650 "ZwOpenThreadToken"
   0x0404  0x0000D660 "ZwOpenThreadTokenEx"
   0x0405  0x0000D670 "ZwOpenTimer"
   0x0406  0x0000D680 "ZwPlugPlayControl"
   0x0407  0x0000D690 "ZwPowerInformation"
   0x0408  0x0000D6A0 "ZwPrivilegeCheck"
   0x0409  0x0000D6B0 "ZwPrivilegeObjectAuditAlarm"
   0x040A  0x0000D6C0 "ZwPrivilegedServiceAuditAlarm"
   0x040B  0x0000D6D0 "ZwProtectVirtualMemory"
   0x040C  0x0000D6E0 "ZwPulseEvent"
   0x040D  0x0000D6F0 "ZwQueryAttributesFile"
   0x040E  0x0000D700 "ZwQueryBootEntryOrder"
   0x040F  0x0000D710 "ZwQueryBootOptions"
   0x0410  0x0000D720 "ZwQueryDebugFilterState"
   0x0411  0x0000D730 "ZwQueryDefaultLocale"
   0x0412  0x0000D740 "ZwQueryDefaultUILanguage"
   0x0413  0x0000D750 "ZwQueryDirectoryFile"
   0x0414  0x0000D760 "ZwQueryDirectoryObject"
   0x0415  0x0000D770 "ZwQueryEaFile"
   0x0416  0x0000D780 "ZwQueryEvent"
   0x0417  0x0000D790 "ZwQueryFullAttributesFile"
   0x0418  0x0000D7A0 "ZwQueryInformationAtom"
   0x0419  0x0000D7B0 "ZwQueryInformationFile"
   0x041A  0x0000D7C0 "ZwQueryInformationJobObject"
   0x041B  0x0000D7D0 "ZwQueryInformationPort"
   0x041C  0x0000D7E0 "ZwQueryInformationProcess"
   0x041D  0x0000D7F0 "ZwQueryInformationThread"
   0x041E  0x0000D800 "ZwQueryInformationToken"
   0x041F  0x0000D810 "ZwQueryInstallUILanguage"
   0x0420  0x0000D820 "ZwQueryIntervalProfile"
   0x0421  0x0000D830 "ZwQueryIoCompletion"
   0x0422  0x0000D840 "ZwQueryKey"
   0x0423  0x0000D850 "ZwQueryMultipleValueKey"
   0x0424  0x0000D860 "ZwQueryMutant"
   0x0425  0x0000D870 "ZwQueryObject"
   0x0426  0x0000D880 "ZwQueryOpenSubKeys"
   0x0427  0x0000D890 "ZwQueryPerformanceCounter"
   0x0428  0x0000DFF0 "ZwQueryPortInformationProcess"
   0x0429  0x0000D8A0 "ZwQueryQuotaInformationFile"
   0x042A  0x0000D8B0 "ZwQuerySection"
   0x042B  0x0000D8C0 "ZwQuerySecurityObject"
   0x042C  0x0000D8D0 "ZwQuerySemaphore"
   0x042D  0x0000D8E0 "ZwQuerySymbolicLinkObject"
   0x042E  0x0000D8F0 "ZwQuerySystemEnvironmentValue"
   0x042F  0x0000D900 "ZwQuerySystemEnvironmentValueEx"
   0x0430  0x0000D910 "ZwQuerySystemInformation"
   0x0431  0x0000D920 "ZwQuerySystemTime"
   0x0432  0x0000D930 "ZwQueryTimer"
   0x0433  0x0000D940 "ZwQueryTimerResolution"
   0x0434  0x0000D950 "ZwQueryValueKey"
   0x0435  0x0000D960 "ZwQueryVirtualMemory"
   0x0436  0x0000D970 "ZwQueryVolumeInformationFile"
   0x0437  0x0000D980 "ZwQueueApcThread"
   0x0438  0x0000D990 "ZwRaiseException"
   0x0439  0x0000D9A0 "ZwRaiseHardError"
   0x043A  0x0000D9B0 "ZwReadFile"
   0x043B  0x0000D9C0 "ZwReadFileScatter"
   0x043C  0x0000D9D0 "ZwReadRequestData"
   0x043D  0x0000D9E0 "ZwReadVirtualMemory"
   0x043E  0x0000D9F0 "ZwRegisterThreadTerminatePort"
   0x043F  0x0000DFD0 "ZwReleaseKeyedEvent"
   0x0440  0x0000DA00 "ZwReleaseMutant"
   0x0441  0x0000DA10 "ZwReleaseSemaphore"
   0x0442  0x0000DA20 "ZwRemoveIoCompletion"
   0x0443  0x0000DA30 "ZwRemoveProcessDebug"
   0x0444  0x0000DA40 "ZwRenameKey"
   0x0445  0x0000DA50 "ZwReplaceKey"
   0x0446  0x0000DA60 "ZwReplyPort"
   0x0447  0x0000DA70 "ZwReplyWaitReceivePort"
   0x0448  0x0000DA80 "ZwReplyWaitReceivePortEx"
   0x0449  0x0000DA90 "ZwReplyWaitReplyPort"
   0x044A  0x0000DAA0 "ZwRequestDeviceWakeup"
   0x044B  0x0000DAB0 "ZwRequestPort"
   0x044C  0x0000DAC0 "ZwRequestWaitReplyPort"
   0x044D  0x0000DAD0 "ZwRequestWakeupLatency"
   0x044E  0x0000DAE0 "ZwResetEvent"
   0x044F  0x0000DAF0 "ZwResetWriteWatch"
   0x0450  0x0000DB00 "ZwRestoreKey"
   0x0451  0x0000DB10 "ZwResumeProcess"
   0x0452  0x0000DB20 "ZwResumeThread"
   0x0453  0x0000DB30 "ZwSaveKey"
   0x0454  0x0000DB40 "ZwSaveKeyEx"
   0x0455  0x0000DB50 "ZwSaveMergedKeys"
   0x0456  0x0000DB60 "ZwSecureConnectPort"
   0x0457  0x0000DB70 "ZwSetBootEntryOrder"
   0x0458  0x0000DB80 "ZwSetBootOptions"
   0x0459  0x0000DB90 "ZwSetContextThread"
   0x045A  0x0000DBA0 "ZwSetDebugFilterState"
   0x045B  0x0000DBB0 "ZwSetDefaultHardErrorPort"
   0x045C  0x0000DBC0 "ZwSetDefaultLocale"
   0x045D  0x0000DBD0 "ZwSetDefaultUILanguage"
   0x045E  0x0000DBE0 "ZwSetEaFile"
   0x045F  0x0000DBF0 "ZwSetEvent"
   0x0460  0x0000DC00 "ZwSetEventBoostPriority"
   0x0461  0x0000DC10 "ZwSetHighEventPair"
   0x0462  0x0000DC20 "ZwSetHighWaitLowEventPair"
   0x0463  0x0000DC30 "ZwSetInformationDebugObject"
   0x0464  0x0000DC40 "ZwSetInformationFile"
   0x0465  0x0000DC50 "ZwSetInformationJobObject"
   0x0466  0x0000DC60 "ZwSetInformationKey"
   0x0467  0x0000DC70 "ZwSetInformationObject"
   0x0468  0x0000DC80 "ZwSetInformationProcess"
   0x0469  0x0000DC90 "ZwSetInformationThread"
   0x046A  0x0000DCA0 "ZwSetInformationToken"
   0x046B  0x0000DCB0 "ZwSetIntervalProfile"
   0x046C  0x0000DCC0 "ZwSetIoCompletion"
   0x046D  0x0000DCD0 "ZwSetLdtEntries"
   0x046E  0x0000DCE0 "ZwSetLowEventPair"
   0x046F  0x0000DCF0 "ZwSetLowWaitHighEventPair"
   0x0470  0x0000DD00 "ZwSetQuotaInformationFile"
   0x0471  0x0000DD10 "ZwSetSecurityObject"
   0x0472  0x0000DD20 "ZwSetSystemEnvironmentValue"
   0x0473  0x0000DD30 "ZwSetSystemEnvironmentValueEx"
   0x0474  0x0000DD40 "ZwSetSystemInformation"
   0x0475  0x0000DD50 "ZwSetSystemPowerState"
   0x0476  0x0000DD60 "ZwSetSystemTime"
   0x0477  0x0000DD70 "ZwSetThreadExecutionState"
   0x0478  0x0000DD80 "ZwSetTimer"
   0x0479  0x0000DD90 "ZwSetTimerResolution"
   0x047A  0x0000DDA0 "ZwSetUuidSeed"
   0x047B  0x0000DDB0 "ZwSetValueKey"
   0x047C  0x0000DDC0 "ZwSetVolumeInformationFile"
   0x047D  0x0000DDD0 "ZwShutdownSystem"
   0x047E  0x0000DDE0 "ZwSignalAndWaitForSingleObject"
   0x047F  0x0000DDF0 "ZwStartProfile"
   0x0480  0x0000DE00 "ZwStopProfile"
   0x0481  0x0000DE10 "ZwSuspendProcess"
   0x0482  0x0000DE20 "ZwSuspendThread"
   0x0483  0x0000DE30 "ZwSystemDebugControl"
   0x0484  0x0000DE40 "ZwTerminateJobObject"
   0x0485  0x0000DE50 "ZwTerminateProcess"
   0x0486  0x0000DE60 "ZwTerminateThread"
   0x0487  0x0000DE70 "ZwTestAlert"
   0x0488  0x0000DE80 "ZwTraceEvent"
   0x0489  0x0000DE90 "ZwTranslateFilePath"
   0x048A  0x0000DEA0 "ZwUnloadDriver"
   0x048B  0x0000DEB0 "ZwUnloadKey"
   0x048C  0x0000DEC0 "ZwUnloadKeyEx"
   0x048D  0x0000DED0 "ZwUnlockFile"
   0x048E  0x0000DEE0 "ZwUnlockVirtualMemory"
   0x048F  0x0000DEF0 "ZwUnmapViewOfSection"
   0x0490  0x0000DF00 "ZwVdmControl"
   0x0491  0x0000DF10 "ZwWaitForDebugEvent"
   0x0492  0x0000DFE0 "ZwWaitForKeyedEvent"
   0x0493  0x0000DF20 "ZwWaitForMultipleObjects"
   0x0494  0x0000DF30 "ZwWaitForSingleObject"
   0x0495  0x0000DF40 "ZwWaitHighEventPair"
   0x0496  0x0000DF50 "ZwWaitLowEventPair"
   0x0497  0x0000DF60 "ZwWriteFile"
   0x0498  0x0000DF70 "ZwWriteFileGather"
   0x0499  0x0000DF80 "ZwWriteRequestData"
   0x049A  0x0000DF90 "ZwWriteVirtualMemory"
   0x049B  0x0000DFA0 "ZwYieldExecution"
   0x049C  0x0000E5C6 "_CIcos"
   0x049D  0x0000E682 "_CIlog"
   0x049E  0x0000E002 "_CIpow"
   0x049F  0x000012D1 "_CIsin"
   0x04A0  0x0000137F "_CIsqrt"
   0x04A1  0x0002C8A2 "__isascii"
   0x04A2  0x0006F64B "__iscsym"
   0x04A3  0x0006F605 "__iscsymf"
   0x04A4  0x0006F5F3 "__toascii"
   0x04A5  0x0000143B "_alldiv"
   0x04A6  0x000014E5 "_alldvrm"
   0x04A7  0x000015C4 "_allmul"
   0x04A8  0x000015F8 "_alloca_probe"
   0x04A9  0x00001635 "_allrem"
   0x04AA  0x000016E9 "_allshl"
   0x04AB  0x00001708 "_allshr"
   0x04AC  0x0006F691 "_atoi64"
   0x04AD  0x00001729 "_aulldiv"
   0x04AE  0x00001791 "_aulldvrm"
   0x04AF  0x00001826 "_aullrem"
   0x04B0  0x0000189B "_aullshr"
   0x04B1  0x000015F8 "_chkstk"
   0x04B2  0x0007B048 "_fltused"
   0x04B3  0x000018BA "_ftol"
   0x04B4  0x0006F80D "_i64toa"
   0x04B5  0x0006F92F "_i64tow"
   0x04B6  0x0002E964 "_itoa"
   0x04B7  0x0002DC81 "_itow"
   0x04B8  0x0006F989 "_lfind"
   0x04B9  0x0006F74E "_ltoa"
   0x04BA  0x0006F867 "_ltow"
   0x04BB  0x000018E1 "_memccpy"
   0x04BC  0x0006F9C2 "_memicmp"
   0x04BD  0x0006F9D2 "_snprintf"
   0x04BE  0x0001BBCA "_snwprintf"
   0x04BF  0x0006FA30 "_splitpath"
   0x04C0  0x00012E44 "_strcmpi"
   0x04C1  0x00012E44 "_stricmp"
   0x04C2  0x0006FB78 "_strlwr"
   0x04C3  0x0001987D "_strnicmp"
   0x04C4  0x0006FBA5 "_strupr"
   0x04C5  0x0006FBD2 "_tolower"
   0x04C6  0x0006FC1F "_toupper"
   0x04C7  0x0006F845 "_ui64toa"
   0x04C8  0x0006F967 "_ui64tow"
   0x04C9  0x0006F77A "_ultoa"
   0x04CA  0x0006F893 "_ultow"
   0x04CB  0x0002FB67 "_vsnprintf"
   0x04CC  0x0006FC31 "_vsnwprintf"
   0x04CD  0x00013358 "_wcsicmp"
   0x04CE  0x00024849 "_wcslwr"
   0x04CF  0x000181CD "_wcsnicmp"
   0x04D0  0x0006FCA7 "_wcsupr"
   0x04D1  0x0006FCDD "_wtoi"
   0x04D2  0x0006FCED "_wtoi64"
   0x04D3  0x0003684A "_wtol"
   0x04D4  0x0006FD8A "abs"
   0x04D5  0x00001934 "atan"
   0x04D6  0x00024889 "atoi"
   0x04D7  0x00024896 "atol"
   0x04D8  0x000151D3 "bsearch"
   0x04D9  0x000019D7 "ceil"
   0x04DA  0x0000E5DA "cos"
   0x04DB  0x0006FD9F "fabs"
   0x04DC  0x00001B18 "floor"
   0x04DD  0x0006F518 "isalnum"
   0x04DE  0x0006F3DC "isalpha"
   0x04DF  0x0006F5C0 "iscntrl"
   0x04E0  0x0002C879 "isdigit"
   0x04E1  0x0006F588 "isgraph"
   0x04E2  0x0006F447 "islower"
   0x04E3  0x0006F550 "isprint"
   0x04E4  0x0006F4E5 "ispunct"
   0x04E5  0x0006F4B2 "isspace"
   0x04E6  0x0006F414 "isupper"
   0x04E7  0x0006FE57 "iswalpha"
   0x04E8  0x000269D1 "iswctype"
   0x04E9  0x00026A75 "iswdigit"
   0x04EA  0x0006FE72 "iswlower"
   0x04EB  0x0006FEA5 "iswspace"
   0x04EC  0x0006FE8A "iswxdigit"
   0x04ED  0x0006F47A "isxdigit"
   0x04EE  0x0006FD8A "labs"
   0x04EF  0x0000E67E "log"
   0x04F0  0x0002490C "mbstowcs"
   0x04F1  0x00001C60 "memchr"
   0x04F2  0x00001D07 "memcmp"
   0x04F3  0x00001DB3 "memcpy"
   0x04F4  0x000020F5 "memmove"
   0x04F5  0x00002435 "memset"
   0x04F6  0x0000DFFD "pow"
   0x04F7  0x000203B8 "qsort"
   0x04F8  0x000012E5 "sin"
   0x04F9  0x00025BA4 "sprintf"
   0x04FA  0x00001393 "sqrt"
   0x04FB  0x0006FEBD "sscanf"
   0x04FC  0x0000249D "strcat"
   0x04FD  0x0000E7ED "strchr"
   0x04FE  0x00002583 "strcmp"
   0x04FF  0x0000248D "strcpy"
   0x0500  0x00002608 "strcspn"
   0x0501  0x00002645 "strlen"
   0x0502  0x000026C0 "strncat"
   0x0503  0x000027E5 "strncmp"
   0x0504  0x0000281D "strncpy"
   0x0505  0x0000291D "strpbrk"
   0x0506  0x00002956 "strrchr"
   0x0507  0x0000297D "strspn"
   0x0508  0x0000E75E "strstr"
   0x0509  0x000700B2 "strtol"
   0x050A  0x000700D1 "strtoul"
   0x050B  0x000184BB "swprintf"
   0x050C  0x000029CE "tan"
   0x050D  0x0006FBE4 "tolower"
   0x050E  0x00023D13 "toupper"
   0x050F  0x0002A826 "towlower"
   0x0510  0x000700F0 "towupper"
   0x0511  0x00020304 "vDbgPrintEx"
   0x0512  0x0001EA5B "vDbgPrintExWithPrefix"
   0x0513  0x00070104 "vsprintf"
   0x0514  0x00018112 "wcscat"
   0x0515  0x00014962 "wcschr"
   0x0516  0x00035424 "wcscmp"
   0x0517  0x00012F40 "wcscpy"
   0x0518  0x000356EE "wcscspn"
   0x0519  0x0000FE2A "wcslen"
   0x051A  0x00018B24 "wcsncat"
   0x051B  0x0001E40F "wcsncmp"
   0x051C  0x0001055F "wcsncpy"
   0x051D  0x00070162 "wcspbrk"
   0x051E  0x00014671 "wcsrchr"
   0x051F  0x000701AB "wcsspn"
   0x0520  0x0002380F "wcsstr"
   0x0521  0x00029F03 "wcstol"
   0x0522  0x000701F9 "wcstombs"
   0x0523  0x00034D91 "wcstoul"